Know Your Agent: Checking an AI Bot’s Permission to Trade

The problem: an eligible investor, an unchecked bot

IN SHORT One agent trade raises three questions: may the receiver hold the token, may this spender move it, and may this bot decide for the investor?

Picture a fund that issues its shares as a security tokenSecurity token A token that stands for a financial security, such as a fund share, whose transfers can be limited to approved holders. See the glossary on ERC-3643, an Ethereum token standard. An investor passes the identity checks. Then she lets an AI agentAI agent Software that uses an AI model to decide and act on its own, here trading tokens for an investor. See the glossary rebalance her holdings.

The left column covers the first two questions. An integration has to keep all three.

ADAM

ADAM says: A mandate works like a limited power of attorney. The image breaks twice. A clerk reads the whole paper, but the contract checks only the mandate’s fields, and the ERC-8226 draft has none for the recipient. Nor does the mandate settle who legally owns the tokens.

A mandate works like a limited power of attorney. The image breaks twice. A clerk reads the whole paper, but the contract checks only the mandate’s fields, and the ERC-8226 draft has none for the recipient. Nor does the mandate settle who legally owns the tokens.

▼

My work on ERC-3643 at Tokeny shapes this analysis. The diagrams show integration choices and review points, not a production report.

WATCH OUT

Correction, 6 September 2026: an earlier version said the ERC-8226 draft’s published pattern could only target ERC-7943. That was too broad. The current draft explicitly documents transferFrom gates and account or executor alternatives.

?Coming up next: So who is the “Agent” that ERC-3643 already knows?

IN SHORT In ERC-3643, the Agent is an admin role the issuer appoints. It is not the investor’s AI agent.

So don’t give investor software the issuer’s Agent role, even if both run as code. It would get a different, and possibly much wider, set of powers.

IN PLAIN WORDS

The issuer’s Agent acts on the token itself. An investor’s mandate defines a scope: one agent, one asset, permitted actions, cap settings, an expiry and a way to revoke it.

?Coming up next: So how does a token check the bot’s mandate on a trade?

IN SHORT On the token-gate path, the mandate check runs in the same transaction as the token’s own checks, so any failure undoes the whole trade.

ERC-8226 gives the mandateMandate A permission an investor grants, directly or by signature, that says what one agent may do on one asset, how much, until when. See the glossary a full life cycle. It is granted, it expires, it can be revoked or frozen, and each use is counted. A compliance provider vouches that the principalPrincipal The investor who grants the mandate and on whose behalf the agent acts. See the glossary, the investor who grants it, is eligible.

In the draft, eligibility is checked when a mandate is granted or extended, not on each trade. So read the real rules for checks and sync. A signed grant alone does not keep the agent authorized.

ITEM GET

Two permissions, both required

On this path, the agent needs both the mandate and the allowanceAllowance The ERC-20 permission that lets another address, the spender, move up to a set amount of your tokens. See the glossary. A mandate alone neither grants ownership nor approves a transfer, and the token’s own rules still decide.

Sources: ERC-3643, ERC-8226 (Draft).